Updated 3 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,766exploited flaws on CISA’s list

36added in the last 30 days

584new WordPress flaws this week

391,288entries in the database

1,264 results · page 22 of 26

Jul 25, 2022Request a Quote: Does not validate uploaded CSV filesCVE-2022-2240 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Request a Quote WordPress plugin through 2.3.7 does not validate uploaded CSV files, allowing unauthenticated users to attach a malicious CSV file to a quote, which could lead to a CSV injection once an admin download and open it
Product
Request a Quote
Affected
up to 2.3.7
What to do
Affects up to 2.3.7. Update Request a Quote to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jul 18, 2022The plugin WP All Import is vulnerable to arbitrary file uploads due to missing file type validation via the wp_all_import_get_gz.php file in versions up to, anCVE-2022-1565 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The plugin WP All Import is vulnerable to arbitrary file uploads due to missing file type validation via the wp_all_import_get_gz.php file in versions up to, and including, 3.6.7. This makes it possible for authenticated attackers, with administrator level permissions and above, to upload arbitrary files on the affected sites server which may make remote code execution possible.
Affected
up to 3.6.7
What to do
Affects up to 3.6.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jun 30, 2022There is an object injection vulnerability in swfupload plugin for wordpress.CVE-2013-4144 · WordPress plugins & themes · reported by Red HatCritical 9.8
There is an object injection vulnerability in swfupload plugin for wordpress.
Affected
3.5.2 to 3.5.2
What to do
Affects 3.5.2 to 3.5.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record github.com openwall.com
Jun 27, 2022Easy SVG Support: Does not sanitise uploaded SVG filesCVE-2022-1964 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy SVG Support WordPress plugin before 3.3.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads
Product
Easy SVG Support
Fixed in
3.3.0
What to do
Update Easy SVG Support to 3.3.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 24, 2022In WordPress Plugin User Photo 0.9.4, when a photo is uploaded, it is only partially validated and it is possible to upload a backdoor on the server hosting WorCVE-2013-1916 · WordPress plugins & themes · reported by Red HatHigh 8.8
In WordPress Plugin User Photo 0.9.4, when a photo is uploaded, it is only partially validated and it is possible to upload a backdoor on the server hosting WordPress. This backdoor can be called (executed) even if the photo has not been yet approved.
Affected
0.9.4 to 0.9.4
What to do
Affects 0.9.4 to 0.9.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordpress.org
Jun 20, 2022Allow svg files: Does not properly validate uploaded filesCVE-2022-1939 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Allow svg files WordPress plugin before 1.1 does not properly validate uploaded files, which could allow high privilege users such as admin to upload PHP files even when they are not allowed to
Product
Allow svg files
Fixed in
1.1
What to do
Update Allow svg files to 1.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 13, 2022Due to missing checks the Change Uploaded File Permissions WordPress plugin through 4.0.0 is vulnerable to CSRF attacks.CVE-2022-1788 · WordPress plugins & themes · reported by WPScanMedium 6.5
Due to missing checks the Change Uploaded File Permissions WordPress plugin through 4.0.0 is vulnerable to CSRF attacks. This can be used to change the file and folder permissions of any folder. This could be problematic when specific files like ini files are made readable for everyone due to this.
Affected
up to 4.0.0
What to do
Affects up to 4.0.0. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 13, 2022WP SVG Icons: Does not properly validate uploaded custom icon packsCVE-2022-0863 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP SVG Icons WordPress plugin through 3.2.3 does not properly validate uploaded custom icon packs, allowing an high privileged user like an admin to upload a zip file containing malicious php code, leading to remote code execution.
Product
WP SVG Icons
Affected
up to 3.2.3
What to do
Affects up to 3.2.3. Update WP SVG Icons to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Jun 8, 2022User Meta: Does not validate the filepath parameter of its um_show_uploaded_file AJAX actionCVE-2022-0779 · WordPress plugins & themes · reported by WPScanMedium 6.5
The User Meta WordPress plugin before 2.4.4 does not validate the filepath parameter of its um_show_uploaded_file AJAX action, which could allow low privileged users such as subscriber to enumerate the local files on the web server via path traversal payloads
Product
User Meta
Fixed in
2.4.4
What to do
Update User Meta to 2.4.4 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 30, 2022Enable SVG: Does not sanitise uploaded SVG filesCVE-2022-1562 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Enable SVG WordPress plugin before 1.4.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads
Product
Enable SVG
Fixed in
1.4.0
What to do
Update Enable SVG to 1.4.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
May 20, 2022Cross-Site Scripting (XSS) vulnerability in WP Wham's Checkout Files Upload for WooCommerce plugin <= 2.1.2 at WordPress.CVE-2022-29425 · WordPress plugins & themes · reported by PatchstackMedium 6.1
Cross-Site Scripting (XSS) vulnerability in WP Wham's Checkout Files Upload for WooCommerce plugin <= 2.1.2 at WordPress.
Affected
up to 2.1.2
What to do
Affects up to 2.1.2. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
May 16, 2022Advanced Uploader: Allows any authenticated users like subscriber to upload arbitrary filesCVE-2022-1103 · WordPress plugins & themes · reported by WPScanHigh 8.8
The Advanced Uploader WordPress plugin through 4.2 allows any authenticated users like subscriber to upload arbitrary files, such as PHP, which could lead to RCE
Product
Advanced Uploader
Affected
up to 4.2
What to do
Affects up to 4.2. Update Advanced Uploader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Apr 29, 2022Rara One Click Demo Import plugin <= 1.2.9 on: Cross-Site Request Forgery (CSRF) leading to Arbitrary File UploadCVE-2022-29451 · WordPress plugins & themes · reported by PatchstackHigh 8.8
Cross-Site Request Forgery (CSRF) leading to Arbitrary File Upload vulnerability in Rara One Click Demo Import plugin <= 1.2.9 on WordPress allows attackers to trick logged-in admin users into uploading dangerous files into /wp-content/uploads/ directory.
Product
Rara One Click Demo Import plugin <= 1.2.9 on
Affected
up to 1.2.9
What to do
Affects up to 1.2.9. Update Rara One Click Demo Import plugin <= 1.2.9 on to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Apr 25, 2022Tatsu: Add_custom_font action can be used without prior authentication to upload a rogue zip fileCVE-2021-25094 · WordPress plugins & themes · reported by WPScanHigh 8.1
The Tatsu WordPress plugin before 3.3.12 add_custom_font action can be used without prior authentication to upload a rogue zip file which is uncompressed under the WordPress's upload directory. By adding a PHP shell with a filename starting with a dot ".", this can bypass extension control implemented in the plugin. Moreover, there is a race condition in the zip extraction process which makes the shell file live long enough on the filesystem to be callable by an attacker.
Product
Tatsu
Fixed in
3.3.12
What to do
Update Tatsu to 3.3.12 or newer.
Full record and what to do →NVD record packetstormsecurity.com darkpills.com
Apr 19, 2022Arbitrary File Upload leading to RCE in E4J s.r.l.CVE-2022-27862 · WordPress plugins & themes · reported by PatchstackCritical 9.8
Arbitrary File Upload leading to RCE in E4J s.r.l. VikBooking Hotel Booking Engine & PMS plugin <= 1.5.3 on WordPress allows attackers to upload and execute dangerous file types (e.g. PHP shell) via the signature upload on the booking form.
Affected
up to 1.5.3
What to do
Affects up to 1.5.3. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Apr 18, 2022sanitisation step of the Safe SVG: Can be bypassed by spoofing the content-type in the POST request to upload a fileCVE-2022-1091 · WordPress plugins & themes · reported by WPScanMedium 6.1
The sanitisation step of the Safe SVG WordPress plugin before 1.9.10 can be bypassed by spoofing the content-type in the POST request to upload a file. Exploiting this vulnerability, an attacker will be able to perform the kinds of attacks that this plugin should prevent (mainly XSS, but depending on further use of uploaded SVG files potentially other XML attacks).
Product
sanitisation step of the Safe SVG
Fixed in
1.9.10
What to do
Update sanitisation step of the Safe SVG to 1.9.10 or newer.
Full record and what to do →NVD record github.com wpscan.com
Apr 4, 2022The JobMonster Theme was vulnerable to Directory Listing in the /wp-content/uploads/jobmonster/ folder, as it did not include a default PHP file, or .htaccess fCVE-2022-1166 · WordPress plugins & themes · reported by WPScanMedium 5.3
The JobMonster Theme was vulnerable to Directory Listing in the /wp-content/uploads/jobmonster/ folder, as it did not include a default PHP file, or .htaccess file. This could expose personal data such as people's resumes. Although Directory Listing can be prevented by securely configuring the web server, vendors can also take measures to make it less likely to happen.
Fixed in
4.6.6.1
What to do
Update the plugin to 4.6.6.1 or newer.
Full record and what to do →NVD record themeforest.net wpscan.com
Apr 4, 2022MapPress Maps for: Allows a high privileged user to bypass the DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS settings and upload arbitrary files to the site through the "ajax_save" functionCVE-2022-0537 · WordPress plugins & themes · reported by WPScanHigh 7.2
The MapPress Maps for WordPress plugin before 2.73.13 allows a high privileged user to bypass the DISALLOW_FILE_EDIT and DISALLOW_FILE_MODS settings and upload arbitrary files to the site through the "ajax_save" function. The file is written relative to the current 's stylesheet directory, and a .php file extension is added. No validation is performed on the content of the file, triggering an RCE vulnerability by uploading a web shell. Further the name parameter is not sanitized, allowing the payload to be uploaded to any directory to which the server has write access.
Product
MapPress Maps for
Fixed in
2.73.13
What to do
Update MapPress Maps for to 2.73.13 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Mar 28, 2022Drag and Drop Multiple File Upload: Allows SVG files to be uploaded by default via the dnd_codedropz_upload AJAX actionCVE-2022-0595 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Drag and Drop Multiple File Upload WordPress plugin before 1.3.6.3 allows SVG files to be uploaded by default via the dnd_codedropz_upload AJAX action, which could lead to Stored Cross-Site Scripting issue
Product
Drag and Drop Multiple File Upload
Fixed in
1.3.6.3
What to do
Update Drag and Drop Multiple File Upload to 1.3.6.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Mar 28, 2022The WordPress File Upload Free and Pro WordPress plugins before 4.16.3 allow users with a role as low as Contributor to perform path traversal via a shortcode aCVE-2021-24962 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WordPress File Upload Free and Pro WordPress plugins before 4.16.3 allow users with a role as low as Contributor to perform path traversal via a shortcode argument, which can then be used to upload a PHP code disguised as an image inside the auto-loaded directory of the plugin, resulting in arbitrary code execution.
Fixed in
4.16.3
What to do
Update the plugin to 4.16.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Mar 23, 2022Ninja Forms - File Uploads Extension: Reflected cross-site scriptingCVE-2022-0889 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to reflected cross-site scripting due to missing sanitization of the files filename parameter found in the ~/includes/ajax/controllers/uploads.php file which can be used by unauthenticated attackers to add malicious web scripts to vulnerable WordPress sites, in versions up to and including 3.3.12.
Product
Ninja Forms - File Uploads Extension
Affected
up to 3.3.12
What to do
Affects up to 3.3.12. Update Ninja Forms - File Uploads Extension to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record ninjaforms.com wordfence.com
Mar 23, 2022Ninja Forms - File Uploads Extension: Arbitrary file uploadsCVE-2022-0888 · WordPress plugins & themes · reported by WordfenceCritical 9.8
The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the ~/includes/ajax/controllers/uploads.php file which can be bypassed making it possible for unauthenticated attackers to upload malicious files that can be used to obtain remote code execution, in versions up to and including 3.3.0
Product
Ninja Forms - File Uploads Extension
Affected
up to 3.3.0
What to do
Affects up to 3.3.0. Update Ninja Forms - File Uploads Extension to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record gist.github.com wordfence.com
Mar 18, 2022Nonce token leak vulnerability leading to arbitrary file upload, theme deletion, plugin settings change discovered in Responsive Menu WordPress plugin (versionsCVE-2022-25602 · WordPress plugins & themes · reported by PatchstackHigh 8.3
Nonce token leak vulnerability leading to arbitrary file upload, theme deletion, plugin settings change discovered in Responsive Menu WordPress plugin (versions <= 4.1.7).
Affected
up to 4.1.7
What to do
Affects up to 4.1.7. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com wordpress.org
Mar 7, 2022WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro: Does not escape some of its shortcode argumentCVE-2021-24961 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro WordPress plugin before 4.16.3 does not escape some of its shortcode argument, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks
Product
WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro
Fixed in
4.16.3
What to do
Update WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro to 4.16.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Mar 7, 2022WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro: Allows users with a roleCVE-2021-24960 · WordPress plugins & themes · reported by WPScanMedium 5.4
The WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro WordPress plugin before 4.16.3 allows users with a role as low as Contributor to configure the upload form in a way that allows uploading of SVG files, which could be then be used for Cross-Site Scripting attacks
Product
WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro
Fixed in
4.16.3
What to do
Update WordPress File Upload WordPress plugin before 4.16.3, wordpress-file-upload-pro to 4.16.3 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Mar 7, 2022All-in-One WP Migration: Does not validate uploaded files' extensionCVE-2021-24216 · WordPress plugins & themes · reported by WPScanHigh 7.2
The All-in-One WP Migration WordPress plugin before 7.41 does not validate uploaded files' extension, which allows administrators to upload PHP files on their site, even on multisite installations.
Product
All-in-One WP Migration
Fixed in
7.41
What to do
Update All-in-One WP Migration to 7.41 or newer.
Full record and what to do →NVD record plugins.trac.wordpress.org wpscan.com
Feb 28, 2022Users of the LearnPress WordPress plugin before 4.1.5 can upload an image as a profile avatar after the registration.CVE-2022-0377 · WordPress plugins & themes · reported by WPScanMedium 4.3
Users of the LearnPress WordPress plugin before 4.1.5 can upload an image as a profile avatar after the registration. After this process the user crops and saves the image. Then a "POST" request that contains user supplied name of the image is sent to the server for renaming and cropping of the image. As a result of this request, the name of the user-supplied image is changed with a MD5 value. This process can be conducted only when type of the image is JPG or PNG. An attacker can use this vulnerability in order to rename an arbitrary image file. By doing this, they could destroy the design of the web site.
Product
LearnPress
Fixed in
4.1.5
What to do
Update LearnPress to 4.1.5 or newer.
Full record and what to do →NVD record bozogullarindan.com github.com
Feb 28, 2022Use Any Font | Custom Font Uploader: Does not have any authorisation checksCVE-2021-24977 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Use Any Font | Custom Font Uploader WordPress plugin before 6.2.1 does not have any authorisation checks when assigning a font, allowing unauthenticated users to sent arbitrary CSS which will then be processed by the frontend for all users. Due to the lack of sanitisation and escaping in the backend, it could also lead to Stored XSS issues
Product
Use Any Font | Custom Font Uploader
Fixed in
6.2.1
What to do
Update Use Any Font | Custom Font Uploader to 6.2.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Dec 21, 2021Directorist: Was vulnerable to Cross-Site Request Forgery to Remote File Upload leading to arbitrary PHP shell uploads in the wp-content/plugins directoryCVE-2021-24981 · WordPress plugins & themes · reported by WPScanHigh 7.5
The Directorist WordPress plugin before 7.0.6.2 was vulnerable to Cross-Site Request Forgery to Remote File Upload leading to arbitrary PHP shell uploads in the wp-content/plugins directory.
Product
Directorist
Fixed in
7.0.6.2
What to do
Update Directorist to 7.0.6.2 or newer.
Full record and what to do →NVD record blog.sucuri.net wpscan.com
Nov 17, 2021WordPress Popular Posts: Arbitrary file uploadsCVE-2021-42362 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WordPress Popular Posts WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the ~/src/Image.php file which makes it possible for attackers with contributor level access and above to upload malicious files that can be used to obtain remote code execution, in versions up to and including 5.3.2.
Product
WordPress Popular Posts
Affected
up to 5.3.2
What to do
Affects up to 5.3.2. Update WordPress Popular Posts to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com blog.nintechnet.com
Nov 1, 2021Stylish Price List: Does not perform capability checks in its spl_upload_ser_img AJAX action (available to authenticated users)CVE-2021-24770 · WordPress plugins & themes · reported by WPScanMedium 6.5
The Stylish Price List WordPress plugin before 6.9.1 does not perform capability checks in its spl_upload_ser_img AJAX action (available to authenticated users), which could allow any authenticated users, such as subscriber, to upload arbitrary images.
Product
Stylish Price List
Fixed in
6.9.1
What to do
Update Stylish Price List to 6.9.1 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 1, 2021Stylish Price List: Does not perform capability checks in its spl_upload_ser_img AJAX action (available to both unauthenticated and authenticated users)CVE-2021-24757 · WordPress plugins & themes · reported by WPScanMedium 5.3
The Stylish Price List WordPress plugin before 6.9.0 does not perform capability checks in its spl_upload_ser_img AJAX action (available to both unauthenticated and authenticated users), which could allow unauthenticated users to upload images.
Product
Stylish Price List
Fixed in
6.9.0
What to do
Update Stylish Price List to 6.9.0 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Nov 1, 2021LearnDash LMS: Does not have any authorisation and validation of the file to be uploaded in the learndash_assignment_process_init() functionCVE-2018-25019 · WordPress plugins & themes · reported by WPScanHigh 7.5
The LearnDash LMS WordPress plugin before 2.5.4 does not have any authorisation and validation of the file to be uploaded in the learndash_assignment_process_init() function, which could allow unauthenticated users to upload arbitrary files to the web server
Product
LearnDash LMS
Fixed in
2.5.4
What to do
Update LearnDash LMS to 2.5.4 or newer.
Full record and what to do →NVD record lists.openwall.net wpscan.com
Oct 21, 2021Catch Themes Demo Import: Arbitrary file uploadsCVE-2021-39352 · WordPress plugins & themes · reported by WordfenceHigh 7.2
The Catch Themes Demo Import WordPress plugin is vulnerable to arbitrary file uploads via the import functionality found in the ~/inc/CatchThemesDemoImport.php file, in versions up to and including 1.7, due to insufficient file type validation. This makes it possible for an attacker with administrative privileges to upload malicious files that can be used to achieve remote code execution.
Product
Catch Themes Demo Import
Affected
up to 1.7
What to do
Affects up to 1.7. Update Catch Themes Demo Import to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com packetstormsecurity.com
Oct 18, 2021Easy Download Manager and File Sharing Plugin with frontend file upload – a better Media Library — Shared Files: Does not sanitise and escape some of its settings before outputting them in attributesCVE-2021-24736 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Easy Download Manager and File Sharing Plugin with frontend file upload – a better Media Library — Shared Files WordPress plugin before 1.6.57 does not sanitise and escape some of its settings before outputting them in attributes, which could lead to Stored Cross-Site Scripting issues.
Product
Easy Download Manager and File Sharing Plugin with frontend file upload – a better Media Library — Shared Files
Fixed in
1.6.57
What to do
Update Easy Download Manager and File Sharing Plugin with frontend file upload – a better Media Library — Shared Files to 1.6.57 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Oct 14, 2021The Brizy Page Builder plugin <= 2.3.11 for WordPress allowed authenticated users to upload executable files to a location of their choice using the brizy_creatCVE-2021-38346 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The Brizy Page Builder plugin <= 2.3.11 for WordPress allowed authenticated users to upload executable files to a location of their choice using the brizy_create_block_screenshot AJAX action. The file would be named using the id parameter, which could be prepended with "../" to perform directory traversal, and the file contents were populated via the ibsf parameter, which would be base64-decoded and written to the file. While the plugin added a .jpg extension to all uploaded filenames, a double extension attack was still possible, e.g. a file named shell.php would be saved as shell.php.jpg, and would be executable on a number of common configurations.
Product
Brizy Page Builder
Affected
up to 2.3.11
What to do
Affects up to 2.3.11. Update Brizy Page Builder to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Oct 11, 2021A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX aCVE-2021-39317 · WordPress plugins & themes · reported by WordfenceHigh 8.8
A WordPress plugin and several WordPress themes developed by AccessPress Themes are vulnerable to malicious file uploads via the plugin_offline_installer AJAX action due to a missing capability check in the plugin_offline_installer_callback function found in the /demo-functions.php file or /welcome.php file of the affected products. The complete list of affected products and their versions are below: WordPress Plugin: AccessPress Demo Importer <=1.0.6 WordPress Themes: accesspress-basic <= 3.2.1 accesspress-lite <= 2.92 accesspress-mag <= 2.6.5 accesspress-parallax <= 4.5 accesspress-root <= 2.5 accesspress-store <= 2.4.9 agency-lite <= 1.1.6 arrival <= 1.4.2 bingle <= 1.0.4 bloger <= 1.2.6 brovy <= 1.3 construction-lite <= 1.2.5 doko <= 1.0.27 edict-lite <= 1.1.4 eightlaw-lite <= 2.1.5 eightmedi-lite <= 2.1.8 eight-sec <= 1.1.4 eightstore-lite <= 1.2.5 enlighten <= 1.3.5 fotography <= 2.4.0 opstore <= 1.4.3 parallaxsome <= 1.3.6 punte <= 1.1.2 revolve <= 1.3.1 ripple <= 1.2.0 sakala <= 1.0.4 scrollme <= 2.1.0 storevilla <= 1.4.1 swing-lite <= 1.1.9 the100 <= 1.1.2 the-launcher <= 1.3.2 the-monday <= 1.4.1 ultra-seven <= 1.2.8 uncode-lite <= 1.3.3 vmag <= 1.2.7 vmagazine-lite <= 1.
Product
affected products. The complete list of affected products and their versions are below:
Affected
up to 1.0.6
What to do
Affects up to 1.0.6. Update affected products. The complete list of affected products and their versions are below: to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record patchstack.com plugins.trac.wordpress.org
Oct 11, 2021Frontend Uploader: Does not prevent HTML files from being uploaded via its formCVE-2021-24563 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Frontend Uploader WordPress plugin through 1.3.2 does not prevent HTML files from being uploaded via its form, allowing unauthenticated user to upload a malicious HTML file containing JavaScript for example, which will be triggered when someone access the file directly
Product
Frontend Uploader
Affected
up to 1.3.2
What to do
Affects up to 1.3.2. Update Frontend Uploader to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record packetstormsecurity.com wpscan.com
Sep 20, 2021Simple Schools Staff Directory: Does not validate uploaded logo pictures to ensure that are indeed imagesCVE-2021-24663 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Simple Schools Staff Directory WordPress plugin through 1.1 does not validate uploaded logo pictures to ensure that are indeed images, allowing high privilege users such as admin to upload arbitrary file like PHP, leading to RCE
Product
Simple Schools Staff Directory
Affected
up to 1.1
What to do
Affects up to 1.1. Update Simple Schools Staff Directory to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 13, 2021The WordPress Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal plugin through 2.2.5 does not check for the uploaded Downloadable Digital prodCVE-2021-24620 · WordPress plugins & themes · reported by WPScanHigh 8.8
The WordPress Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal plugin through 2.2.5 does not check for the uploaded Downloadable Digital product file, allowing any file, such as PHP to be uploaded by an administrator. Furthermore, as there is no CSRF in place, attackers could also make a logged admin upload a malicious PHP file, which would lead to RCE
Product
WordPress Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal
Affected
up to 2.2.5
What to do
Affects up to 2.2.5. Update WordPress Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 13, 2021The shopp_upload_file AJAX action of the Shopp WordPress plugin through 1.4, available to both unauthenticated and authenticated user does not have any securityCVE-2021-24493 · WordPress plugins & themes · reported by WPScanCritical 9.8
The shopp_upload_file AJAX action of the Shopp WordPress plugin through 1.4, available to both unauthenticated and authenticated user does not have any security measure in place to prevent upload of malicious files, such as PHP, allowing unauthenticated users to upload arbitrary files and leading to RCE
Product
Shopp
Affected
up to 1.4
What to do
Affects up to 1.4. Update Shopp to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Sep 13, 2021Email Artillery (MASS EMAIL): Does not properly check the uploaded files from the Import Emails featureCVE-2021-24490 · WordPress plugins & themes · reported by WPScanMedium 6.8
The Email Artillery (MASS EMAIL) WordPress plugin through 4.1 does not properly check the uploaded files from the Import Emails feature, allowing arbitrary files to be uploaded. Furthermore, the plugin is also lacking any CSRF check, allowing such issue to be exploited via a CSRF attack as well. However, due to the presence of a .htaccess, denying access to everything in the folder the file is uploaded to, the malicious uploaded file will only be accessible on Web Servers such as Nginx/IIS
Product
Email Artillery (MASS EMAIL)
Affected
up to 4.1
What to do
Affects up to 4.1. Update Email Artillery (MASS EMAIL) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 16, 2021Photo Gallery by 10Web – Mobile-Friendly Image Gallery: Did not ensure that uploaded files are kept inside its uploads folderCVE-2021-24363 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin before 1.5.75 did not ensure that uploaded files are kept inside its uploads folder, allowing high privilege users to put images/SVG anywhere in the filesystem via a path traversal vector
Product
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
Fixed in
1.5.75
What to do
Update Photo Gallery by 10Web – Mobile-Friendly Image Gallery to 1.5.75 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 16, 2021Photo Gallery by 10Web – Mobile-Friendly Image Gallery: Did not ensure that uploaded SVG files added to a gallery do not contain malicious contentCVE-2021-24362 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin before 1.5.75 did not ensure that uploaded SVG files added to a gallery do not contain malicious content. As a result, users allowed to add images to gallery can upload an SVG file containing JavaScript code, which will be executed when accessing the image directly (ie in the /wp-content/uploads/photo-gallery/ folder), leading to a Cross-Site Scripting (XSS) issue
Product
Photo Gallery by 10Web – Mobile-Friendly Image Gallery
Fixed in
1.5.75
What to do
Update Photo Gallery by 10Web – Mobile-Friendly Image Gallery to 1.5.75 or newer.
Full record and what to do →NVD record wpscan.com wpscan.com
Aug 9, 2021Workreap: AJAX actions workreap_award_temp_file_uploader and workreap_temp_file_uploader did not perform nonce checksCVE-2021-24499 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Workreap WordPress theme before 2.2.2 AJAX actions workreap_award_temp_file_uploader and workreap_temp_file_uploader did not perform nonce checks, or validate that the request is from a valid user in any other way. The endpoints allowed for uploading arbitrary files to the uploads/workreap-temp directory. Uploaded files were neither sanitized nor validated, allowing an unauthenticated visitor to upload executable code such as php scripts.
Product
Workreap
Fixed in
2.2.2
What to do
Update Workreap to 2.2.2 or newer.
Full record and what to do →NVD record packetstormsecurity.com jetpack.com
Aug 5, 2021Authenticated File Upload in WordPress Download Manager <= 3.1.24 allows authenticated (Author+) users to upload files with a double extension, e.g.CVE-2021-34639 · WordPress plugins & themes · reported by WordfenceHigh 7.5
Authenticated File Upload in WordPress Download Manager <= 3.1.24 allows authenticated (Author+) users to upload files with a double extension, e.g. "payload.php.png" which is executable in some configurations. This issue affects: WordPress Download Manager version 3.1.24 and prior versions.
Affected
up to 3.1.24
What to do
Affects up to 3.1.24. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Jul 21, 2021WooCommerce Stock Manager: Cross-Site Request Forgery leading to Arbitrary File UploadCVE-2021-34619 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WooCommerce Stock Manager WordPress plugin is vulnerable to Cross-Site Request Forgery leading to Arbitrary File Upload in versions up to, and including, 2.5.7 due to missing nonce and file validation in the /woocommerce-stock-manager/trunk/admin/views/import-export.php file.
Product
WooCommerce Stock Manager
Affected
up to 2.5.7
What to do
Affects up to 2.5.7. Update WooCommerce Stock Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record plugins.trac.wordpress.org wordfence.com
Jul 7, 2021A vulnerability in the getSelectedMimeTypesByRole function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to view custom extCVE-2021-34627 · WordPress plugins & themes · reported by WordfenceMedium 4.3
A vulnerability in the getSelectedMimeTypesByRole function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to view custom extensions added by administrators. This issue affects versions 2.2.3 and prior.
Product
WP Upload Restriction
Affected
up to 2.2.3
What to do
Affects up to 2.2.3. Update WP Upload Restriction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Jul 7, 2021A vulnerability in the deleteCustomType function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to delete custom extensions CVE-2021-34626 · WordPress plugins & themes · reported by WordfenceMedium 4.3
A vulnerability in the deleteCustomType function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to delete custom extensions added by administrators. This issue affects versions 2.2.3 and prior.
Product
WP Upload Restriction
Affected
up to 2.2.3
What to do
Affects up to 2.2.3. Update WP Upload Restriction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com
Jul 7, 2021A vulnerability in the saveCustomType function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to inject arbitrary web scriptCVE-2021-34625 · WordPress plugins & themes · reported by WordfenceMedium 6.4
A vulnerability in the saveCustomType function of the WP Upload Restriction WordPress plugin allows low-level authenticated users to inject arbitrary web scripts. This issue affects versions 2.2.3 and prior.
Product
WP Upload Restriction
Affected
up to 2.2.3
What to do
Affects up to 2.2.3. Update WP Upload Restriction to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD record wordfence.com wordfence.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.